infrastructure/ansible/plays/common.yaml

320 lines
9.3 KiB
YAML
Raw Normal View History

2023-09-12 00:35:35 +02:00
- name: Setup SSH Config
hosts: all
become: true
become_user: root
tags:
- setup_ssh
- setup
tasks:
- name: Authorized_keys dir present
ansible.builtin.file:
state: directory
path: /etc/ssh/authorized_keys
owner: root
group: root
mode: '0755'
2023-09-14 11:30:13 +02:00
- name: Obtain Machine Pubkey
delegate_to: localhost
become: false
changed_when: false
register: pubkey
2023-09-14 14:54:09 +02:00
ansible.builtin.command:
cmd: "ssh-keygen -y -f {{ ansible_ssh_private_key_file }}"
2023-09-15 18:00:27 +02:00
- name: Deploy SSH-Keys
vars:
machine_key: "{{ pubkey.stdout }}"
ansible.builtin.template:
src: "authorized_keys.j2"
dest: "/etc/ssh/authorized_keys/{{ ansible_user }}"
owner: root
group: root
mode: '0644'
2023-09-12 00:35:35 +02:00
- name: Ensure authorized_keys ownership
ansible.builtin.file:
state: directory
path: /etc/ssh/authorized_keys
owner: root
group: root
mode: "u=rwX,g=rX,o=rX"
recurse: true
- name: Configure sshd
ansible.builtin.template:
src: 'sshd_config.j2'
dest: '/etc/ssh/sshd_config.d/99-override.conf'
owner: root
group: root
mode: '0600'
- name: Remove Keys Config
ansible.builtin.file:
state: absent
path: /etc/ssh/ssh_config.d/40-ssh-key-dir.conf
2023-09-12 03:27:12 +02:00
- name: Setup Networks
hosts: network_config
become: true
become_user: root
tasks:
- name: Setup wired interface
ansible.builtin.template:
src: "connection.nmconnection.j2"
dest: "/etc/NetworkManager/system-connections/Wired Connection 1.nmconnection"
owner: root
group: root
mode: '0600'
2023-09-12 10:49:23 +02:00
notify: Restart Network
- name: Setup DNS
ansible.builtin.lineinfile:
path: /etc/systemd/resolved.conf
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
notify: Restart systemd-resolved
loop:
- regexp: "^DNS="
line: "DNS=1.1.1.1"
- regexp: "^FallbackDNS="
line: "FallbackDNS=8.8.8.8"
2023-09-12 03:27:12 +02:00
handlers:
2023-09-12 10:49:23 +02:00
- name: Restart Network
2023-09-12 03:27:12 +02:00
ansible.builtin.systemd:
name: NetworkManager.service
state: restarted
2023-09-12 10:49:23 +02:00
- name: Restart systemd-resolved
ansible.builtin.systemd:
name: systemd-resolved.service
state: restarted
2023-09-12 03:27:12 +02:00
2023-09-12 00:35:35 +02:00
2023-03-30 23:52:40 +02:00
- name: Backup
hosts: backup
become: true
become_user: root
2023-12-25 17:45:59 +01:00
vars:
repo_path: "/var/home/backup/storagebox/{{ inventory_hostname }}"
password: "{{ backup.password }}"
pushkey: "{{ backup.pushkey }}"
2023-03-30 23:52:40 +02:00
tasks:
- name: Install backup script
2023-12-25 17:45:59 +01:00
vars:
repo: "ssh://{{ common.backup.user }}@{{ common.backup.url }}{{ repo_path }}"
2023-03-30 23:52:40 +02:00
ansible.builtin.template:
src: backup.sh.j2
dest: /root/backup.sh
mode: '0700'
owner: root
2023-12-25 17:45:59 +01:00
- name: Generate SSH directory
ansible.builtin.file:
2023-03-30 23:52:40 +02:00
path: /root/.ssh
owner: root
state: directory
mode: '0700'
2023-12-25 17:45:59 +01:00
- name: Generate SSH Key
community.crypto.openssh_keypair:
path: /root/.ssh/borgbackup
type: ed25519
2023-03-30 23:52:40 +02:00
owner: root
2023-12-25 17:45:59 +01:00
mode: '0600'
register: keypair
- name: Register SSH Key with backup server
become: true
become_user: root
delegate_to: backup.unruhig.eu
ansible.builtin.lineinfile:
path: /etc/ssh/authorized_keys/backup
state: present
search_string: "{{ keypair.public_key }}"
line: 'command="borg serve --restrict-to-repository {{ repo_path }}",restrict {{ keypair.public_key }}'
2023-03-30 23:52:40 +02:00
- name: Add Known Hosts entries
ansible.builtin.known_hosts:
path: "/root/.ssh/known_hosts"
2023-12-25 17:45:59 +01:00
name: "backup.unruhig.eu"
key: "{{ item }}"
loop: "{{ hostvars['backup.unruhig.eu']['known_hosts'] }}"
2023-03-30 23:52:40 +02:00
- name: Restore from Backup
hosts: backup
2023-03-30 23:52:40 +02:00
become: true
become_user: root
gather_facts: true
2023-12-25 17:45:59 +01:00
vars:
repo_path: "/var/home/backup/storagebox/{{ inventory_hostname }}"
password: "{{ backup.password }}"
pushkey: "{{ backup.pushkey }}"
2023-03-30 23:52:40 +02:00
tasks:
- name: Check if restore is needed
ansible.builtin.stat:
path: "/etc/setup_complete"
register: setup_complete
2023-03-30 23:52:40 +02:00
- block:
- name: Install restore script
2023-12-25 17:45:59 +01:00
vars:
repo: "ssh://{{ common.backup.user }}@{{ common.backup.url }}{{ repo_path }}"
2023-03-30 23:52:40 +02:00
ansible.builtin.template:
src: restore.sh.j2
dest: /root/restore.sh
mode: '0700'
owner: root
2023-12-25 17:45:59 +01:00
- name: Stop and mask backup service
become: true
become_user: root
ansible.builtin.systemd:
name: "borgbackup.service"
state: stopped
masked: true
2023-03-30 23:52:40 +02:00
- name: Restore from Borg
become: true
become_user: root
ansible.builtin.command:
chdir: /
cmd: bash /root/restore.sh
- name: Remove script from host
ansible.builtin.file:
path: /root/restore.sh
state: absent
- name: Mark setup as complete
ansible.builtin.file:
path: "/etc/setup_complete"
state: touch
owner: root
group: root
mode: 0600
2023-12-25 17:45:59 +01:00
- name: Unmask backup service
become: true
become_user: root
ansible.builtin.systemd:
name: "borgbackup.service"
state: stopped
masked: false
when: not setup_complete.stat.exists
2023-03-30 23:52:40 +02:00
- name: Setup Registry credentials
hosts: all
tasks:
- ansible.builtin.file:
path: /home/core/.docker
owner: core
state: directory
mode: '0700'
- ansible.builtin.template:
src: docker-config.json.j2
dest: /home/core/.docker/config.json
mode: '0600'
owner: core
- name: Setup Docker Config
hosts: all
become: true
become_user: root
tasks:
- name: Template Config
ansible.builtin.template:
src: "docker-daemon.json.j2"
dest: /etc/docker/daemon.json
owner: root
group: root
mode: '0600'
notify: Restart Docker
- name: Setup default ulimts
ansible.builtin.lineinfile:
path: /etc/sysconfig/docker
search_string: '--default-ulimit nofile='
line: ' --default-ulimit nofile=4096:4096 \'
notify: Restart Docker
- name: Remove log-driver from sysconfig
ansible.builtin.lineinfile:
path: /etc/sysconfig/docker
search_string: '--log-driver='
state: absent
notify: Restart Docker
- name: Restart Docker if necessary
meta: flush_handlers
handlers:
- name: Restart Docker
ansible.builtin.systemd:
state: restarted
name: docker.service
2023-08-10 16:29:52 +02:00
- name: Setup internal networks
hosts: all
tasks:
- name: Setup network
community.docker.docker_network:
name: "{{ item }}"
internal: true
loop: "{{ docker.internal_networks | default([]) }}"
2023-04-06 01:03:25 +02:00
- name: Setup Push Monitoring
hosts: all
tags:
- never
- setup_monitoring
2023-09-12 00:35:35 +02:00
- setup
2023-04-06 01:03:25 +02:00
tasks:
- name: Login to Kuma
delegate_to: localhost
2023-04-06 19:57:36 +02:00
check_mode: false
2023-04-06 01:03:25 +02:00
lucasheld.uptime_kuma.login:
api_url: "{{ kuma.api_url }}"
api_username: "{{ kuma.api_username }}"
api_password: "{{ kuma.api_password }}"
register: kumalogin
- name: Create Kuma Monitor
delegate_to: localhost
2023-04-06 19:57:36 +02:00
check_mode: false
2023-04-06 01:03:25 +02:00
lucasheld.uptime_kuma.monitor:
api_url: "{{ kuma.api_url }}"
api_token: "{{ kumalogin.token }}"
name: "{{ inventory_hostname }}"
description: "Managed by Ansible"
type: push
2023-09-15 13:53:23 +02:00
interval: "{{ heartbeat_timer_interval|mandatory + 30 }}"
2023-04-06 01:03:25 +02:00
maxretries: 2
notification_names:
- "Kuma Statusmonitor"
state: present
- name: Obtain Kuma Push Token
delegate_to: localhost
2023-04-06 19:57:36 +02:00
check_mode: false
2023-04-06 01:03:25 +02:00
lucasheld.uptime_kuma.monitor_info:
api_url: "{{ kuma.api_url }}"
api_token: "{{ kumalogin.token }}"
name: "{{ inventory_hostname }}"
register: monitor
- name: Check if user is lingering
stat:
path: "/var/lib/systemd/linger/{{ ansible_user }}"
register: user_lingering
2023-04-06 19:13:33 +02:00
- name: Enable lingering for user if needed
2023-04-06 01:03:25 +02:00
command: "loginctl enable-linger {{ ansible_user }}"
when:
- not user_lingering.stat.exists
- name: Create systemd config dir
file:
state: directory
path: "/home/{{ ansible_user }}/.config/systemd/user"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: '0755'
- name: Copy Push Monitor Service and Timer
ansible.builtin.template:
src: "{{ item }}.j2"
dest: "/home/{{ ansible_user }}/.config/systemd/user/{{ item }}"
mode: '0600'
owner: "{{ ansible_user }}"
vars:
monitor_url: "{{ kuma.api_url }}/api/push/{{ monitor.monitors[0].pushToken }}?status=up&msg=OK"
loop:
- heartbeat.service
- heartbeat.timer
- name: Enable timer
ansible.builtin.systemd:
scope: user
name: heartbeat.timer
state: started
enabled: true
masked: false
daemon_reload: true
2023-09-12 03:30:01 +02:00
- name: Setup Infrastructure Wireguard
tags:
2023-11-11 23:28:00 +01:00
- never
2023-09-12 03:30:01 +02:00
- setup
- setup_wireguard
- setup_vpn
ansible.builtin.import_playbook: vpn.yaml
2023-09-14 11:30:13 +02:00
# vim: ft=yaml.ansible